Multiple vulnerabilities have been discovered in Oracle Virtualbox, the worst of which could result in root privilege escalation.

Announced

2022-08-31

Revised

2022-08-31

Access

remote

Bugs

#785445 #803134 #820425 #831440 #839990 #859391

Advisory

https://security.gentoo.org/glsa/202208-36

Affected packages

Package	Arch	Vulnerable	Unaffected
app-emulation/virtualbox	*	< 6.1.36	>= 6.1.36
app-emulation/virtualbox-additions	*	< 6.1.36	>= 6.1.36
app-emulation/virtualbox-extpack-oracle	*	< 6.1.36	>= 6.1.36
app-emulation/virtualbox-guest-additions	*	< 6.1.36	>= 6.1.36
app-emulation/virtualbox-modules	*	< 6.1.36	>= 6.1.36

Background

VirtualBox is a powerful virtualization product from Oracle.

Description

Multiple vulnerabilities have been discovered in VirtualBox. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All VirtualBox users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-6.1.36"

References

• CVE-2021-2145
• CVE-2021-2250
• CVE-2021-2264
• CVE-2021-2266
• CVE-2021-2279
• CVE-2021-2280
• CVE-2021-2281
• CVE-2021-2282
• CVE-2021-2283
• CVE-2021-2284
• CVE-2021-2285
• CVE-2021-2286
• CVE-2021-2287
• CVE-2021-2291
• CVE-2021-2296
• CVE-2021-2297
• CVE-2021-2306
• CVE-2021-2309
• CVE-2021-2310
• CVE-2021-2312
• CVE-2021-2409
• CVE-2021-2442
• CVE-2021-2443
• CVE-2021-2454
• CVE-2021-2475
• CVE-2021-35538
• CVE-2021-35540
• CVE-2021-35542
• CVE-2021-35545
• CVE-2022-21394
• CVE-2022-21465
• CVE-2022-21471
• CVE-2022-21487
• CVE-2022-21488
• CVE-2022-21554
• CVE-2022-21571

Multiple vulnerabilities have been found in VirtualBox, the worst of which could allow an attacker to take control of VirtualBox.

Announced

2018-02-11

Revised

2018-02-11

Access

local, remote

Bugs

#644894

Advisory

https://security.gentoo.org/glsa/201802-01

Affected packages

Package	Arch	Vulnerable	Unaffected
app-emulation/virtualbox	*	< 5.1.32	>= 5.1.32
app-emulation/virtualbox-bin	*	< 5.1.32.120294	>= 5.1.32.120294
app-emulation/virtualbox-guest-additions	*	< 5.1.32	>= 5.1.32

Background

VirtualBox is a powerful virtualization product from Oracle.

Description

Multiple vulnerabilities have been discovered in VirtualBox. Please review the CVE identifiers referenced below for details.

Impact

An attacker could take control of VirtualBox resulting in the execution of arbitrary code with the privileges of the process, a Denial of Service condition, or other unspecified impacts.

Workaround

There is no known workaround at this time.

Resolution

All VirtualBox users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-5.1.32"

All VirtualBox Binary users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=app-emulation/virtualbox-bin-5.1.32.120294"

All VirtualBox Guest Additions users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=app-emulation/virtualbox-guest-additions-5.1.32"

References

• CVE-2018-2676
• CVE-2018-2685
• CVE-2018-2686
• CVE-2018-2687
• CVE-2018-2688
• CVE-2018-2689
• CVE-2018-2690
• CVE-2018-2693
• CVE-2018-2694
• CVE-2018-2698

Multiple vulnerabilities in VirtualBox were found, the worst of which allowing for privilege escalation.

Announced

2010-01-13

Revised

2010-01-13

Access

local

Bugs

#288836 #294678

Advisory

https://security.gentoo.org/glsa/201001-04

Affected packages

Package	Arch	Vulnerable	Unaffected
app-emulation/virtualbox-bin	*	< 3.0.12	>= 3.0.12
app-emulation/virtualbox-guest-additions	*	< 3.0.12	>= 3.0.12
app-emulation/virtualbox-ose	*	< 3.0.12	>= 3.0.12
app-emulation/virtualbox-ose-additions	*	< 3.0.12	>= 3.0.12

Background

The VirtualBox family provides powerful x86 virtualization products.

Description

Thomas Biege of SUSE discovered multiple vulnerabilities:

• A shell metacharacter injection in popen() (CVE-2009-3692) and a possible buffer overflow in strncpy() in the VBoxNetAdpCtl configuration tool.
• An unspecified vulnerability in VirtualBox Guest Additions (CVE-2009-3940).

Impact

A local, unprivileged attacker with the permission to run VirtualBox could gain root privileges. A guest OS local user could cause a Denial of Service (memory consumption) on the guest OS via unknown vectors.

Workaround

There is no known workaround at this time.

Resolution

All users of the binary version of VirtualBox should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-bin-3.0.12"

All users of the Open Source version of VirtualBox should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-ose-3.0.12"

All users of the binary VirtualBox Guest Additions should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-guest-additions-3.0.12"

All users of the Open Source VirtualBox Guest Additions should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/virtualbox-ose-additions-3.0.12"

References

• CVE-2009-3692
• CVE-2009-3940